Question

A financial services company is designing a new customer portal on Azure. The architecture uses Azure App Service (PaaS) for the web tier, Azure SQL Database (PaaS) for data, and a set of Azure Virtual Machines (IaaS) running a legacy risk-calculation engine. During a Well-Architected Framework security review, the CISO asks which security responsibilities the company itself must own across these services, rather than relying on Microsoft. Which statement most accurately reflects the shared responsibility model the architect should communicate?

Accepted Answer

For the App Service and SQL Database, the customer remains responsible for data classification, access management, and application-level configuration, while for the VMs the customer additionally owns guest OS patching and endpoint protection.

Answer

For all three services, Microsoft manages the physical hosts, and the customer is always responsible for guest OS patching, network controls, and identity configuration.

Answer

Because App Service and SQL Database are PaaS, the customer has no security responsibilities for those tiers and only needs to secure the IaaS VMs.

Answer

Microsoft assumes full responsibility for identity and access management across PaaS and IaaS, so the customer only needs to configure network segmentation for the VMs.